CVE-2014-2047: Medium severity ownCloud ownCloud vulnerability
Session fixation vulnerability in ownCloud before 6.0.2, when PHP is configured to accept session parameters through a GET request, allows remote attackers to hijack web sessions via unspecified vectors.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ownCloudto a version that resolves this vulnerability.Fixed in 6.0.2 - Configuration
Ensure PHP is not configured to accept session parameters through a GET request (disable GET-based session parameter handling) to mitigate session fixation in ownCloud before 6.0.2.
PHP accept session parameters through a GET request = disabled - Compensating control
If immediate upgrade is not possible, restrict exposure of the affected ownCloud instance to reduce opportunities for remote session hijacking attempts.
Event History
Frequently Asked Questions
What is the severity of CVE-2014-2047?
CVE-2014-2047 has a medium severity rating, as it enables session fixation attacks.
How do I fix CVE-2014-2047?
To fix CVE-2014-2047, upgrade ownCloud to version 6.0.2 or later to mitigate the vulnerability.
Which versions of ownCloud are affected by CVE-2014-2047?
CVE-2014-2047 affects ownCloud versions prior to 6.0.2, including 6.0.0 and 6.0.1.
What kind of attacks can exploit CVE-2014-2047?
CVE-2014-2047 can be exploited to hijack user web sessions through session fixation attacks.
Is the session fixation vulnerability in CVE-2014-2047 critical?
CVE-2014-2047 is not considered critical, but it poses a notable risk to user session integrity.